The secure CMS.
Resources
Topics
- Home
- Development (317)
- Geeklog (209)
- Plugins (111)
- Themes (2)
- News (387)
- Announcements (248)
- Geeklog.net (31)
- Security (76)
- Spam (11)
- Summer of Code (27)
User Functions
Events
What's New
Stories
1 new Stories in the last 2 weeksComments last 2 weeks
Trackbacks last 2 weeks
No new trackback commentsLinks last 2 weeks
No recent new linksNEW FILES last 14 days
No new filesWelcome to Geeklog Saturday, May 25 2013 @ 04:38 PM EDT
Geeklog 1.8.2sr1 and 2.0.0rc2
- Wednesday, February 20 2013 @ 05:40 AM EST
-
- Contributed by:
- Dirk
-
- Views:
- 2,657
We have received two reports about security issues that affect Geeklog in both current versions, i.e. 1.8.2 and 2.0.0 (which is not officially out yet, but in release candidate state):
- High-Tech Bridge Security Research Lab reported an XSS in the calendar_type parameter in the Calendar plugin.
- Trustwave Spiderlabs reported XSS in the install script, the Configuration, as well as in the Admin interfaces for the Polls plugin and the Topic editor.
To address these issues, we are releasing Geeklog 1.8.2sr1 (complete archive; also available as an update from 1.8.2) and Geeklog 2.0.0rc2.
In addition to the security fixes, Geeklog 1.8.2sr1 also fixes a problem with the Twitter OAuth login. Geeklog 2.0.0rc2 includes further (non-security) bugfixes for this major update.
While the reported security issues are not easy to exploit (due to other security measures in Geeklog), we strongly suggest that you install these updates as soon as possible. Also, be careful when clicking on external links while being logged in as an Admin user - especially when you are unexpectedly prompted for your password.
Trackback
- Trackback URL for this entry:
- http://www.geeklog.net/trackback.php/geeklog-1.8.2sr1
No trackback comments for this entry.
The following comments are owned by whomever posted them. This site is not responsible for what they say.
Tom
Geeklog 1.8.1 to 1.8.2 Upgrade
and then:
Security Update for Geeklog 1.8.2
Why? We have never provided such upgrades in the past. In fact, the 1.8.2 upgrade package that Tom provided was already an exception - we only provide such "diff" upgrades for security issues. Is it really that much work for you to download and install two such files?
I'm all for making updates as easy as possible, but please consider that it's a lot of work for us to provide all these extra archives. And where will it stop? Someone is surely going to ask for a "diff" archive from 1.8.0 next ...
It's needed because some of us use custom files. This requires re-customization every time a new version comes out. In this case it means double re-customization.
function COM_nl2br($string)
{
if (! defined('XHTML')) {
define('XHTML', '');
}
$replace = '<br' . XHTML . '>';
$find = array("\r\n", "\n\r", "\r", "\n");
return str_replace($find, $replace, $string);
}